Commit 1164f54
deps: fix segfault during gc
This is part 2/2 of the fixes needed for v8:4871. This fix never landed
upstream because the bug is not present in active V8 version. The patch
is available from the upstream v8 bug however.
The segfault occurs at the intersection of the following three
conditions that are dependent on the allocation pattern of an
application: A pretenured (1) allocation site has to be optimized into
a merged allocation by the allocation folding optimization (2) and
there needs to be overflow of the store buffer (3).
This patch disables the allocation folding optimization for pretenured
allocations. This may have some, hopefully negligible, performance
impact on real world applications.
Fixes: #5900
PR-URL: #7303
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>1 parent d9e9d9f commit 1164f54
1 file changed
Lines changed: 5 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3693,6 +3693,11 @@ Representation HUnaryMathOperation::RepresentationFromInputs() { | |||
| 3693 | 3693 | ||
| 3694 | 3694 | bool HAllocate::HandleSideEffectDominator(GVNFlag side_effect, | |
| 3695 | 3695 | HValue* dominator) { | |
| 3696 | + if (IsOldSpaceAllocation()) { | ||
| 3697 | + // Do not fold old space allocations because the store buffer might need | ||
| 3698 | + // to iterate old space pages during scavenges on overflow. | ||
| 3699 | + return false; | ||
| 3700 | + } | ||
| 3696 | 3701 | DCHECK(side_effect == kNewSpacePromotion); | |
| 3697 | 3702 | Zone* zone = block()->zone(); | |
| 3698 | 3703 | Isolate* isolate = block()->isolate(); | |
0 commit comments